CVE-2026-4197: D-Link DNS-1550-04 download_mgr.cgi RSS_Item_List command injection
A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function RSSGetUpdateStatus/RSSUpdate/RSSChannelAutoDownlaod/RSSAdd/RSSChannelItemDownlaod/RSSHistoryItemList/RSSItemList of the file /cgi-bin/downloadmgr.cgi. The manipulation results in command injection. The attack may be performed from remote. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4197?
CVE-2026-4197 is considered a high-severity command injection vulnerability affecting several D-Link devices.
How do I fix CVE-2026-4197?
To fix CVE-2026-4197, update the affected D-Link device firmware to the latest version provided by the vendor.
What devices are affected by CVE-2026-4197?
CVE-2026-4197 affects multiple D-Link models including DNS-120, DNR-202L, DNS-315L, and several others.
What type of vulnerability is CVE-2026-4197?
CVE-2026-4197 is classified as a command injection vulnerability that allows attackers to execute arbitrary commands on affected D-Link devices.
Is CVE-2026-4197 remotely exploitable?
Yes, CVE-2026-4197 can be remotely exploited if the D-Link devices are exposed to the internet.